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5 November 1979 

Computer Security Sub-Committee 
Contractor Sharing of Computers 


UNITED. STATES GOVERNMENT 

memorandum 

Serial: T4/456/79 


Chairman, Security Committee 

The attached memo was prepared by Computer Security Sub-Committee 


(CIA) and 


member 

reason for the memo is to alert you to 


J (DIA) at my request. The 
an increasing problem of a single 

contractor doing work for more than one government agency. Our particular 
concern is the sharing of computers for multiple contracts, but the general 
problem of overall security supervi sors and general use of physical facilit es 
may be of interest to your committe 



"Chairman 
Computer Security/ Sub-Committee 


Enel : 
a/ s 
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MEMORANDUM FOR THE RECORD 5 November 1979 

SUBJECT: Contractor Sharing of Computers 

1. Numerous contractor organizations utilize ADP equipment for 
processing and storing SCI information. Traditionally, the approved 
method for processing such classified material is either to dedicate a 
computer system to process compartmented data only, or to allocate a 
specific number of hours on a computer for single compartment processing. 
The latter method is known as ^periods processing" and requires sanitiza- 
tion procedures before and after the dedicated period. Both dedicated 
and periods processing type operations can degrade the efficiency of the 
computer resources. They are particularly not cost effective for the 
contractors if changes in the type of data processed are frequent, or if 
the machines cannot be utilized full time. For this reason, contractors 
wish to utilize more economical alternatives for processing data. They 
are now seeking advice and guidance to achieve eventual system security 
approval. The problem is compounded when a single contractor utilizes 
the same ADP system to satisfy contractual obligations for multiple NFIB 
customers. 


2. The issues, stemming from contractor proposals for alternate 
data processing methods, relate to regulations, areas of jurisdiction 

and NFIB resources. First, current regulations are not always sufficiently 
detailed to provide complete guidance for the different contractor 
situations. Regulations will be reviewed by the CSS with a view to 
producing standard contractor ADP security policy for inclusion in DCID 
1/16. Secondly, guidelines must be formulated to establish a cognizant 
computer security authority for each facility where NFIB members share 
contractor computer facilities. This authority would monitor the operation 
for security and effectiveness and would be the focal point for arbitration 
when problems arise. Lastly, the problem of resources must be faced. 

At present, no single NFIB member has the resources or overall expertise 
to devote full time effort to resolving the many computer security 
issues in dealing with the contractors. Therefore, methods for augmenting 
these resources and reducing unnecessary duplication of effort will be 
investigated. 

3. This paper is intended to alert SECOM of a trend in the computer 
processing of SCI data by contractors which requires policy review and 
will increase the demands upon ADP security resources of the NFIB members. 
As CSS work progresses and recommendations are developed, the results 
will be forwarded to SECOM for information and concurrence. 
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